The Agent Skills Directory

[COMMAND_EXECUTION]: The _auth.py script uses subprocess.run to execute a login script located in a sibling skill directory (chanjing-credentials-guard). This facilitates user authentication but involves executing local files outside the skill's immediate script directory.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides tools that ingest and process external URLs provided by the user, creating a surface for potential network-based attacks or unauthorized data retrieval.\n
Ingestion points: Detected in download_result.py via the --url argument and in create_task.py via the --callback argument.\n
Boundary markers: The SKILL.md file contains instructions for the user to evaluate the trust and accessibility of the callback URL before use.\n
Capability inventory: The skill possesses network request capabilities (urllib.request) and the ability to write files to the outputs/video-compose/ directory.\n
Sanitization: The download_result.py script uses urllib.parse.urlparse and Path.name to sanitize filenames, providing protection against basic path traversal, but does not validate the domain of the source URL.\n- [DYNAMIC_EXECUTION]: Multiple scripts (create_task.py, poll_task.py, list_figures.py, upload_file.py) utilize __import__('os') for dynamic access to environment variables. Additionally, _auth.py dynamically resolves the file path for a sibling script at runtime.

chanjing-video-compose